Skip to main content

​
Overview

Goose is an open-source Rust coding agent with CLI, desktop app (Electron), and server modes. Uses system keyring for credentials.
Binary path: ~/.local/bin/goose
Config: ~/Library/Application Support/Block.goose/ (macOS)
Dependencies: $$require=55-integrations-optional/keychain.sb$$
License: Apache-2.0 (open source)

​
Sandbox Profile

(allow file-read* file-write*
    (home-prefix "/.local/bin/goose")
    (home-subpath "/.goose")
    (home-subpath "/.config/goose")
    (home-subpath "/.cache/goose")
    (home-subpath "/.local/share/goose")
    (home-subpath "/.local/state/goose")
    (home-subpath "/Library/Application Support/Block.goose")
)

​
Running in Safehouse

# Interactive mode
safehouse --enable=keychain,network --add-dirs="$PWD" -- goose

# Web mode (binds port 3000)
safehouse --enable=keychain,network --add-dirs="$PWD" \
    --append-profile=<(echo '(allow network-bind (local tcp \"localhost:3000\"))') \
    -- goose web

​
Execution Modes

  1. CLI (Interactive) — Custom TUI with rustyline/cliclack/bat
  2. Desktop App — Electron app (React + HTTP/WebSocket to goosed)
  3. Web mode — goose web binds axum server on port 3000
  4. Server — goosed binary (HTTP/WebSocket API)

​
Keyring Integration

Goose uses the keyring crate with:
  • macOS: apple-native (Security.framework)
  • Linux: sync-secret-service (D-Bus)
  • Windows: windows-native (Credential Manager)
Service name: goose, username: secrets Fallback: ~/.config/goose/secrets.yaml (plaintext YAML)

​
OAuth Flows

ProviderPortEndpoints
MCP OAuthRandom (127.0.0.1:0)Dynamic per-server
DatabricksConfigureddatabricks/oauth
ChatGPT/Codex127.0.0.1:16372OpenAI auth
OpenRouter127.0.0.1:3000openrouter.ai
Tetrate127.0.0.1:3000Tetrate endpoints

​
MCP Extension Servers

Goose includes built-in MCP servers:
  • Developer — File editing, shell, screen capture, memory
  • Computer Controller — AppleScript (macOS), shell automation
  • Memory — Project-local and global storage
  • Tutorial — Onboarding/help
  • Auto-visualiser — Data visualization

​
Screen Capture

Uses xcap crate for screenshots:
  • Full display capture
  • Specific window capture
  • Window list enumeration

​
Security Considerations

No built-in sandboxing. Goose runs with full user permissions.Critical capabilities:
  • Arbitrary shell execution via developer extension
  • macOS AppleScript (osascript -e) for full system automation
  • Screen capture (reads screen contents)
  • Docker control (docker exec/run)

​
Configuration Files

PathPurpose
~/.config/goose/config.yamlMain config
~/.config/goose/secrets.yamlFallback secrets (if keyring disabled)
~/.config/goose/custom_providers/Custom model definitions
~/.config/goose/recipes/Global recipes
~/.config/goose/memory/Global memory
~/.local/share/goose/sessions/sessions.dbSQLite session storage

Build docs developers (and LLMs) love

Get started for freeTalk to us